Wireshark · Ethereal-users: Re: [Ethereal-users] Hex address as source

[Sake Blok <sake@xxxxxxxxxx>]

On Mon, Apr 17, 2006 at 03:49:29PM -0400, Dan Brown wrote:
>  
> I recently started testing Ethereal and I have a question about the
> source and destination addresses.  Much of the traffic I am trying to
> identify is old IPX data from the previous network.  Unfortunately the
> Source address is always in what I assume is hex, it looks like this:
>  
> 00000000.000048af8d6c
>  
> I was expecting an IP address so I'm not really sure how I can use this
> information.  Could someone set me straight?  Thanks!

IPX and IP are two different Layer-3 protocols, with each having their own
addressing-scheme. The hex-address you are seeing is the IPX layer-3
address. It is built up from the network number (00000000) and the
node address (000048af8d6c). In IPX, the L3 node-address is the
same as the L2 node address (mac-address), which makes the use
of arp unnecessary, but now im getting off topic... ;)

In newer versions of Novell, the IPX protocol was dropped in favor
of the IP protocol, because of it's wide-spread use. Is Novell still
needed in your network? If so, you might want to read something
about the IPX protocol.


I hope this helps :)


Cheers,   Sake